4 ms·
So apparently Google rolled out an update where they 'm.domain.com' turn into 'domain.com' in the omnibox. In what world is this acceptable? How can they assume
by pyentropy 7y ago
So apparently Google rolled out an update where they 'm.domain.com' turn into 'domain.com' in the omnibox. In what world is this acceptable? How can they assume that 'm.' always means mobile and 'www.' is the same as the root domain for all hosts?
Let's assume that you have a blog platform offering subdomains for each user and 'm.blogplatform.com' is available. Now, any user can get that subdomain and impersonate the homepage because Emily from Chromium decided that eliding parts of the URL without any spec is a reasonable decision.
- joshuamorton 7y agoYes, that's why that change was rolled back.
- saalweachter 7y agoI hate to break it to you, but if you allow www.companyname.website, companyname.website, and m.companyname.website to be owned by different entities, your users are already being phished.
- type0 7y agosimply not true, you are confusing different issues
- rnotaro 7y agoTumblr have a url scheme where subdomains are user-owned. https://m.tumblr.com/ https://m.tumblr.com/ != https://tumblr.com https://tumblr.com When they initially decided to hide the "m" subdomain, https://m.tumblr.com/ https://m.tumblr.com/ was shwon as tumblr.com. It's not the only website with that issue.